CVE-2026-66269 is a high severity (CVSS 7.3) unsafe reflection flaw in Dell OpenManage Server Administrator (OMSA). The record says versions before 11.1.0.3 are affected, and that an unauthenticated attacker with remote access could bypass a protection mechanism. Update OMSA to 11.1.0.3 or later.
What's affected
Dell's record says OpenManage Server Administrator versions prior to 11.1.0.3 are affected. The fixed version, 11.1.0.3, comes from the same record. The weakness is CWE-470, use of externally controlled input to select classes or code, commonly called unsafe reflection.
The Dell advisory is DSA-2026-403, titled as a security update for OMSA network access vulnerabilities. Dell's support site refused my request with an access denied page, so I could only confirm the advisory title from the reference URL. I have not read its list of other issues, affected operating systems or download links. Read it before you plan the rollout.
The record's description says "Protection mechanism bypass" as the impact. It does not spell out further consequences, and I will not add any.
How to check if you're exposed
OMSA is the agent that lets you manage a Dell PowerEdge server from its operating system. Find the servers that run it, and read the installed version. The product's own web interface and package list show the version, and so does your configuration management inventory. Dell's advisory has the exact steps for each operating system.
The record says an unauthenticated attacker with remote access could exploit the flaw. So the first question is whether the OMSA web interface is reachable from networks beyond your management segment. If it is reachable from user networks or the internet, treat this as urgent.
What to do now
- List every server that has OMSA installed and record its version.
- Update OMSA to 11.1.0.3 or later using Dell's advisory DSA-2026-403.
- Restrict access to the OMSA web port to your management network with a firewall rule, whether or not you have patched yet.
- If OMSA is not needed on a server, remove it.
- Check the Dell advisory for other fixes bundled into the same release.
Why it matters
Unsafe reflection happens when code takes a name from the outside, such as a class or function name, and uses it to decide what code to run. If the software does not limit the names to a safe list, a caller can steer execution toward code the developers never meant to expose. In this case Dell describes the result as a bypass of a protection mechanism.
Server management tooling holds a privileged position. It runs close to the hardware and often with high rights, so a weakness that an unauthenticated user can reach over the network deserves attention even at a score of 7.3. The reach is the reason to move fast, and the version bump is the fix.
No source I reviewed says this CVE is exploited in the wild, and the record's KEV flag is false.
Quick check
Do I need credentials to exploit it?
The record says no. It describes an unauthenticated attacker with remote access, which is why network restriction is a useful stop gap.
Which version fixes it?
The record says OMSA versions prior to 11.1.0.3 are affected, so 11.1.0.3 or later. Confirm against Dell advisory DSA-2026-403.
Sources
- Dell advisory DSA-2026-403 for OpenManage Server Administrator (could not be opened from my environment)
- NVD record for CVE-2026-66269
Last reviewed: 18 October 2026.
